Make certificate/private key configuration fallible

Author: ctz

src/conf.rs

@@ -180,7 +180,7 @@ impl SslConfigCtx {
             State::ApplyingToCtx(ctx) => {
                 // the "Certificate" command after `SSL_CONF_CTX_set_ssl_ctx` is documented as using
                 // `SSL_CTX_use_certificate_chain_file`.
-                ctx.get_mut().stage_certificate_chain(cert_chain);
+                ctx.get_mut().stage_certificate_chain(cert_chain)?;
                 ActionResult::Applied
             }
             State::ApplyingToSsl(_) => {

src/entry.rs

@@ -283,8 +283,10 @@ entry! {
                     }
                 };
 
-                ctx.get_mut().stage_certificate_chain(chain);
-                C_INT_SUCCESS as i64
+                match ctx.get_mut().stage_certificate_chain(chain) {
+                    Err(e) => e.raise().into(),
+                    Ok(()) => C_INT_SUCCESS as i64,
+                }
             }
             Ok(SslCtrl::SetTlsExtServerNameArg) => {
                 ctx.get_mut().set_servername_callback_context(parg);
@@ -479,8 +481,10 @@ entry! {
             Err(err) => return err.raise().into(),
         };
 
-        ctx.get_mut().stage_certificate_chain(chain);
-        C_INT_SUCCESS
+        match ctx.get_mut().stage_certificate_chain(chain) {
+            Ok(()) => C_INT_SUCCESS,
+            Err(e) => e.raise().into(),
+        }
     }
 }
 
@@ -523,8 +527,10 @@ entry! {
         let x509 = OwnedX509::new_incref(x);
         let ee = CertificateDer::from(x509.der_bytes());
 
-        ctx.get_mut().stage_certificate_end_entity(ee);
-        C_INT_SUCCESS
+        match ctx.get_mut().stage_certificate_end_entity(ee) {
+            Ok(()) => C_INT_SUCCESS,
+            Err(e) => e.raise().into(),
+        }
     }
 }
 
@@ -958,8 +964,10 @@ entry! {
                     }
                 };
 
-                ssl.get_mut().stage_certificate_chain(chain);
-                C_INT_SUCCESS as i64
+                match ssl.get_mut().stage_certificate_chain(chain) {
+                    Ok(()) => C_INT_SUCCESS as i64,
+                    Err(e) => e.raise().into(),
+                }
             }
             Ok(SslCtrl::GetNegotiatedGroup) => ssl
                 .get()
@@ -1448,8 +1456,10 @@ entry! {
         let x509 = OwnedX509::new_incref(x);
         let ee = CertificateDer::from(x509.der_bytes());
 
-        ssl.get_mut().stage_certificate_end_entity(ee);
-        C_INT_SUCCESS
+        match ssl.get_mut().stage_certificate_end_entity(ee) {
+            Ok(()) => C_INT_SUCCESS,
+            Err(e) => e.raise().into(),
+        }
     }
 }
 

src/lib.rs

@@ -678,11 +678,17 @@ impl SslContext {
         self.cert_callback = callbacks::CertCallbackConfig { cb, context };
     }
 
-    fn stage_certificate_end_entity(&mut self, end: CertificateDer<'static>) {
+    fn stage_certificate_end_entity(
+        &mut self,
+        end: CertificateDer<'static>,
+    ) -> Result<(), error::Error> {
         self.auth_keys.stage_certificate_end_entity(end)
     }
 
-    fn stage_certificate_chain(&mut self, chain: Vec<CertificateDer<'static>>) {
+    fn stage_certificate_chain(
+        &mut self,
+        chain: Vec<CertificateDer<'static>>,
+    ) -> Result<(), error::Error> {
         self.auth_keys.stage_certificate_chain(chain)
     }
 
@@ -933,11 +939,17 @@ impl Ssl {
         self.mode == ConnMode::Server
     }
 
-    fn stage_certificate_end_entity(&mut self, end: CertificateDer<'static>) {
+    fn stage_certificate_end_entity(
+        &mut self,
+        end: CertificateDer<'static>,
+    ) -> Result<(), error::Error> {
         self.auth_keys.stage_certificate_end_entity(end)
     }
 
-    fn stage_certificate_chain(&mut self, chain: Vec<CertificateDer<'static>>) {
+    fn stage_certificate_chain(
+        &mut self,
+        chain: Vec<CertificateDer<'static>>,
+    ) -> Result<(), error::Error> {
         self.auth_keys.stage_certificate_chain(chain)
     }
 

src/sign.rs

@@ -34,12 +34,20 @@ pub struct CertifiedKeySet {
 }
 
 impl CertifiedKeySet {
-    pub fn stage_certificate_chain(&mut self, chain: Vec<CertificateDer<'static>>) {
+    pub fn stage_certificate_chain(
+        &mut self,
+        chain: Vec<CertificateDer<'static>>,
+    ) -> Result<(), error::Error> {
         self.pending_cert_chain = Some(chain);
+        Ok(())
     }
 
-    pub fn stage_certificate_end_entity(&mut self, end: CertificateDer<'static>) {
+    pub fn stage_certificate_end_entity(
+        &mut self,
+        end: CertificateDer<'static>,
+    ) -> Result<(), error::Error> {
         self.pending_cert_end_entity = Some(end);
+        Ok(())
     }
 
     pub fn commit_private_key(&mut self, key: EvpPkey) -> Result<(), error::Error> {